To subcontract development work to another company, you keep the client contract and sign a second, mirroring contract with the subcontractor. Then you manage the gaps between the two.
The client relationship stays with you, and so does the delivery risk, whoever writes the code.
Definitions, freelancer tips and sample clauses are easy to find. But a missing clause isn't the only place money leaks. It also leaks where the two contracts disagree: a requirement in one statement of work (SOW) and not the other, or a warranty that ends too early.
This playbook covers the model, the contract stack, three predictable failure modes with the arithmetic, and a clause checklist to run before you sign.
How does subcontracting software development work?
Your agency signs with the client, then hires another company to build some or all of what you sold. The client's contract is with you alone, and so is the subcontractor's. The client and the subcontractor never sign with each other.
Two documents do most of the work. An MSA (master services agreement) holds the standing legal terms of a relationship: liability, IP, payment, termination. An SOW (statement of work) sits under it and sets one project's scope, acceptance criteria, dates and price.
The model comes in three shapes:
| Model | Is the client told? | Who signs with the client | Who carries delivery risk |
|---|---|---|---|
| Silent white-label | Not by name | Your agency | Your agency |
| Disclosed subcontract | Yes, and consents | Your agency | Your agency |
| Referral or co-contract | Yes | The subcontractor, or both | Whoever signs each scope |
This guide covers the first two, and it's about the paper. For the margin side, see the economics of white-label work.
Who carries the delivery risk?
You do. The client can only enforce its contract against the company it signed with. Every late sprint, bug or data incident from the subcontractor lands on your agency first.
EU data law spells this out for personal data. If your client decides how its customers' data is used, it's the "controller." Your agency, handling that data for it, is a "processor." Under GDPR Article 28(4), a processor must impose "the same data protection obligations" on any processor it engages. If that one fails, the first "shall remain fully liable" (GDPR Article 28, 2016).
Unless your client contract says otherwise, the same logic covers the whole job. You can hand over the work, not the responsibility.
That risk sits on a thin margin. Promethean Research's Digital Agency Industry Report, drawing on surveys of 1,452 agency leaders, puts the average agency's 2025 net margin at 13% (Promethean Research, 2026).
Here's the illustration used through the rest of this guide. The numbers are round and hypothetical:
- Your agency sells a fixed-price web app build for $60,000.
- You subcontract it: 700 hours at $40 an hour, or $28,000. That rate sits inside outsourcing advisory firm Accelerance's senior developer band for Asia, $31 to $41 an hour (Accelerance, 2025).
- At a 13% net margin on the sale price, the project leaves about $7,800 of profit ($60,000 × 0.13).
Every gap between your two contracts is paid out of that $7,800.
Which contracts do you need?
You need the same core documents on both sides: an MSA, an SOW, confidentiality terms and, if personal data is involved, a data processing agreement (DPA). The subcontract also carries a non-solicit protecting your client relationship.
| Document | Client and agency | Agency and subcontractor |
|---|---|---|
| MSA | Your legal terms with the client | Mirrors the client MSA wherever the work passes through |
| SOW | Scope, acceptance, dates, price | Names the client SOW version it matches |
| NDA | Mutual NDA, or a confidentiality clause in the MSA | Back-to-back NDA, signed before you name the client |
| DPA | Needed if you handle the client's personal data | The same obligations, passed down |
| Non-solicit | Optional: stops the client hiring your staff | Covers your clients and your staff |
A back-to-back NDA protects the client's information at least as well as your NDA with the client does. The definition of confidential information must be as wide. The survival period (how long the duty lasts after the contract ends) must be as long. Say the client NDA survives five years and the subcontractor's survives two. Years three to five are your exposure alone.
A non-solicit (non-solicitation clause) stops the subcontractor from taking work from your client or hiring your staff, during the engagement and for a set period after. Word it to cover accepting work too, because the obvious loophole is the client calling first. Enforceability varies by jurisdiction, so have a lawyer draft it.
IP needs a written assignment. Commissioned work is "made for hire" only in nine listed categories, and only with a signed agreement (US Copyright Office, Circular 30, 2024). Custom software usually falls outside them. So the subcontractor assigns rights to you as code is created, and you assign them on. The full chain is in who owns the code a partner writes.
What does back-to-back mean in practice?
Back-to-back means sorting every client term into three piles: copy it down, copy it down and tighten it, or keep it agency-only. Lawyers call the terms you pass down flow-down clauses. "Flow everything down" fails both ways: the subcontractor inherits terms it can't meet, and you lose your buffers.
Law firm Harper James describes back-to-back agreements as sub-contracts "that mirror all or part of the terms of a main contract" (Harper James, 2020). Here's how the terms sort:
Copy as written
- Confidentiality obligations
- Data protection obligations
- Coding standards and acceptance criteria
Copy and tighten
- Deadlines and acceptance windows that end before yours
- Notice periods and fix times shorter than yours
- Warranty, security and access rules
Agency-only
- Your price and payment terms with the client
- Client contacts and account plans
- Your brand and roadmap
The tightened terms are your buffer. Say the client gives you 10 business days to fix a reported defect. Give the subcontractor 5, and keep the other 5 for your own review.
One client term fits no pile: the liability cap. Mark it N and negotiate it against your own exposure. Some protections, such as the non-solicit, exist only in the subcontract.
Before you sign, print the client contract and mark every clause C, T, A or N. Anything left unmarked is a gap.
What if scope drifts between contracts?
Scope drift here means the two SOWs describe the same project differently, or change at different times. The subcontractor builds to its SOW, the client accepts against its own, and your agency pays for the difference.
Drift can start innocently. The subcontractor SOW is written from a sales summary, or a change approved on a call never reaches the subcontract.
Here's how that plays out in the illustration. The client SOW requires WCAG 2.2 AA, the W3C's accessibility guidelines at their middle conformance level. The subcontractor SOW says "responsive, works in modern browsers."
At acceptance, the client's accessibility audit fails. The subcontractor, correctly by its own paper, prices the fix as a change: 110 hours × $40 = $4,400. That's 56% of the $7,800 profit ($4,400 ÷ $7,800), lost to one sentence. In the rework terms below, it's a spec error: your brief was incomplete, so your agency pays.
Three habits prevent it:
Attach, don't summarize
The subcontractor SOW attaches or quotes the client's requirements. It names the client SOW version it matches, such as "v1.3, signed March 12."
Move change orders in pairs
Every client change order triggers a subcontractor change order. No changed work starts until both are signed.
Keep one change log
One list, owned by your delivery lead, shows each change, both prices and both signatures.
Test it now: pick three requirements from your client SOW and find them in the subcontractor SOW. If one's missing, you've found your drift.
What if the client finds out?
Discovery becomes a real problem in three cases: your client contract restricts subcontracting, a subcontractor handles personal data without written authorization, or someone has called the work in-house. Solve all three up front.
Small things can give it away: a commit author with another company's email, or an engineer who emails the client directly. Check your client MSA for a subcontracting clause first. If it requires written consent, working without it is a breach, however good the code.
For personal data under the GDPR, written authorization isn't optional. A processor "shall not engage another processor without prior specific or general written authorisation of the controller" (GDPR Article 28(2), 2016).
Then make discovery a non-event:
- General consent in the client MSA: you may use vetted subcontractors, stay fully responsible, and name them on request. With personal data, also tell the client before adding or replacing one, so it can object.
- Agency-owned accounts: the subcontractor works in your Git organization, chat and email domain, so you can remove access in a day.
- One channel: the subcontractor contacts the client only if you've agreed it in writing.
- A publicity clause: agree whether the subcontractor may show the project in its portfolio.
If the client asks you directly, tell the truth. White-label hides a brand. It doesn't license a false answer.
Who pays for rework?
Who pays depends on why the code failed, so agree three categories before the project starts: a defect, a change or a spec error. Each has a different payer. Without these definitions, a rework dispute is just two invoices arguing.
| Category | What it means | Who pays |
|---|---|---|
| Defect | The code fails acceptance criteria in the subcontractor SOW | The subcontractor, under warranty |
| Change | The client wants something the client SOW didn't include | The client, through a change order that flows down |
| Spec error | Your brief to the subcontractor was wrong or incomplete | Your agency |
Then check the warranty dates. Here's the timeline in the illustration:
- Day 0: the subcontractor delivers to you. Its warranty runs 30 days from delivery.
- Day 21: after your testing, the client accepts.
- Day 30: the subcontractor's warranty ends.
- Day 111: your 90-day warranty to the client ends (21 + 90).
From day 31 to day 111, 81 days, your agency carries every defect alone. A defect found on day 60 takes 40 hours to fix: 40 × $40 = $1,600, billed to you as new work.
Put the two gaps together:
The fix is three lines in the subcontract. Start its warranty at client acceptance and make it at least as long as yours. Define a defect against the SOW's acceptance criteria. Set fix times shorter than the ones you gave the client.
If you're weighing a delivery partner for work you've already sold, a free 30-minute scoping call can cover scope, warranty and change control first.
What should a subcontractor agreement include?
A subcontractor agreement should include every clause below, checked side by side against the client contract. Run the list before you sign either one.
Security terms deserve extra care. Verizon's 2025 Data Breach Investigations Report found the share of breaches involving a third party doubled, from 15% to 30% (Verizon DBIR, 2025).
| Clause | What to check | Rule |
|---|---|---|
| Scope | Quotes the client requirements and names the client SOW version | Copy |
| Change control | Signed subcontractor change order before changed work starts | Copy and tighten |
| Acceptance | Same criteria; the subcontractor's window ends before yours | Copy and tighten |
| Warranty and fix times | Starts at client acceptance, lasts as long as yours, faster fixes | Copy and tighten |
| Defect definition | Defect, change and spec error defined against the SOW | Copy and tighten |
| Liability cap | Compared with your exposure to the client; the difference is yours | Negotiate |
| Insurance | Professional liability (E&O) and cyber coverage at least matching what the client requires of you | Copy |
| IP assignment | Assigned to you on creation, including the subcontractor's staff | Copy |
| IP infringement indemnity | A promise to cover claims the code copies someone else's work, at least as wide as yours | Copy |
| Confidentiality | Back-to-back NDA, same scope, same or longer survival | Copy |
| Data protection | Your DPA's obligations; no further processors without your written authorization | Copy |
| Security and access | Your accounts, least privilege (only the access each person needs), removable in a day | Copy and tighten |
| Further subcontracting | None without your written consent | Copy and tighten |
| Key personnel | Named engineers; replacements need your approval | Copy and tighten |
| Termination | Ends on the same or shorter notice if the client ends yours | Copy and tighten |
| Governing law and disputes | Same law and venue where possible; the subcontractor cooperates in client disputes | Copy and tighten |
| Non-solicit | Your clients and staff; covers accepting work | Subcontract-only |
| Payment timing | Stated in days, aligned to your client milestones | Subcontract-only |
| Publicity | Portfolio use only with your written consent | Subcontract-only |
Vet the company before the paper. How to vet an offshore development partner covers that step, and offshore development red flags lists warning signs in a partner's own contract.
When is subcontracting the wrong move?
Subcontracting is the wrong move when you can't inspect the work, the contract forbids it, or the economics don't hold. Skip it, or fix the underlying problem first, in these cases:
- No technical reviewer on your side. You carry the risk, so someone must be able to judge a pull request.
- The client contract forbids it, or requires named or security-cleared staff.
- It's your differentiator. Handing out what clients hire you for hollows out what you sell.
- The margin can't absorb a gap. In the illustration, two gaps took 77% of the profit.
- The project is tiny. On a two-week job, the paperwork can outweigh the saving.
- The gap is permanent. If you subcontract the same role every month, compare it with hiring or a dedicated offshore development team.
Frequently asked questions
Should the subcontractor sign my client's NDA directly?
Not unless the client requires it. Your back-to-back NDA already carries the client's terms down to the subcontractor, and it keeps you as the single point of contact.
What happens to the subcontract if my client cancels?
It depends on why. If the client ends for convenience, end the subcontract the same way and pay for work done. If the client ends for cause over the subcontractor's work, your warranty and liability terms decide what you can recover.
Can I pay the subcontractor only when my client pays me?
You can propose it, but expect the subcontractor to price in the risk, and enforceability depends on your governing law. A middle ground is paying a fixed number of days after each milestone you accept.
Where should you start?
Before you subcontract development work to another company, start with the client contract you already have. Mark every clause copy, tighten, agency-only or negotiate, then build the subcontract from that list. Two contracts that behave like one keep the client, the risk and the margin where you expect them.
This is general information, not legal advice.